Cisco Cisco UCS B440 M1 High-Performance Blade Server Libro blanco
© 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.
Page 9 of 23
Figure 7. Cisco Secure Enclaves Management Structure
Security Philosophy: The Reference Monitor
The three most basic and necessary characteristics of the components that enforce security and instill trust are
as follows:
●
The mechanism must be protected from modification by unauthorized methods and users.
●
The mechanism must not be allowed to be bypassed.
●
The mechanism must be simple to understand and monitor.
These core requirements together help ensure the trustworthiness of the enforcement module: the Monitor.
Design Principles
Design principles are rules and guidelines instituted to help ensure, inform, and support the way in which an
architectural implementation fulfills its mission. They provide a means to tie components and methods to the
business objectives: protection, performance, and provisioning.
In a security platform, trust is paramount and must not be misplaced. In a system consisting of components of
varying levels of trustworthiness, the assumption is that the overall trustworthiness of the system matches the least
trustworthy subcomponent. Security is enforced through access control, which requires complete visibility into
whatever is being secured. Relevant principles, the rationale for inclusion in an enclave, and the scope of an
enclave are summarized here.
●
Least-common mechanism: This principle states the need to globalize common and shared modules (in
the enforcement domain). It has the effect of reducing duplicates, which can result in fewer opportunities for
compromise. It also has the advantage of less overhead, because there are fewer instances, and potentially
better performance. Another positive effect of implementing this principle is ease of maintenance.
●
Reduced sharing: In the user domain, no computer resource should be shared between components or
subjects unless it is necessary to do so. This approach helps prevent both inadvertent and deliberate
encroachment. When information needs to be shared, it should be done only if sharing has been explicitly
requested and granted.